MALICIOUS — Doom 3 trainer.exe

MALICIOUS — Doom 3 trainer.exe is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (97/100), attributed to the Upantix family. 6 of 55 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: e431cbf1feba270a4dcc0e837d8b4951abe11f2eb3da8fdf0e516d4f19dad70d
SHA-1: 6b8f223a97fbbf4a108889d9ebf246a8e10d18ac
MD5: 03c8018447d30b087b49913ad32fa633
imphash: 24b60c57cc33f3e633431b7ad497fda7
ssdeep: 1536:3UUUUUUUUUUHdTD+vvvvvvvvvh+UUUUUUUC9mIkkkkkkTyhhhhhhhMSTZM+9m2On:blN9RkkkkkkTLSBvC
TLSH: T1E43AD000317A388CDB309F611564595DA12552C28A7C3DEB9B030B2D2D778BBB8E8F76
Submitted as: Doom 3 trainer.exe
File type: pe · Size: 101485 bytes
Verdict: malicious (97/100) · Family: Upantix

Detections (6 of 55 engines)

MalwareAnalyser heuristics (entropy/packer): UPX
ClamAV (daily): Win.Trojan.Generic-9908425-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Detect It Easy (packer/type): DIE:Turbo Linker
Microsoft Defender: Trojan:Win32/Upantix.GM!MTB
Kaspersky (KVRT): HEUR:Packed.Win32.Upantix.gen

MITRE ATT&CK

Why this verdict

The malicious score of 97/100 is the fusion of 7 weighted signals:

ClamAV (daily) flagged Win.Trojan.Generic-9908425-0 (rule Win.Trojan.Generic-9908425-0) - engine signal, weight 0.90, confidence 0.95
Contacted 22 external host(s) at runtime (22 HTTP) - network signal, weight 0.40, confidence 0.80
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
Detect It Easy (packer/type) flagged DIE:Turbo Linker (rule DIE:Turbo Linker) - engine signal, weight 0.35, confidence 0.70
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
Packing/obfuscation: UPX, high-entropy-sections:UPX1, Turbo Linker - static signal, weight 0.25, confidence 0.55
Dropped 7 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60

Dynamic analysis (windows)

198 behavior events · 0 ATT&CK techniques · 7 dropped files.

Dropped files

C:\Windows\win32dc\Sims 2 + codes.exe - f2855ac7433c2585618aae2e7ffd75fd39a13f0c2ae38308c9641f3a8c702c85
C:\Windows\win32dc\Counter-Strike_serial.exe - b5dc88603c8ea3eb4d542590224a53654b36419d2d108896d2f8ab901c75fe53
C:\Windows\win32dc\Doom 3 + patch.exe - 22758ae1b007a0ae2908bfac8a70a94a92368f0190998d0ef519ec022309c0fd
C:\Windows\win32dc\UT2004(cheat).exe - 20b715b9aa51245eda909f2ea674b3d71d974263d68b32d53bd37d9e23cf5da3
C:\Windows\win32dc\BattleField 1942_hack.exe - 2b3aa5b494fbb2435e9eed743dac7640a62cc1c9d67fadebf151011d737574df
C:\Windows\win32dc\FlatOut cdfix.exe - b93029a4cae7e81307656f8db943ec4ec3257488ed93946fa7fffd0593fc810d
C:\Windows\win32dc\Doom 3 codes.exe - f3c1f200aa90eb5a79ebbf7cd4607b0496b9fa6c19030b8b662d9aee83ccbbf6

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787637975&P2=404&P3=2&P4=FTXNCESoqGJMdjXLLtLZaWyCeta1xWLHGxULmxXGw%2fZ8rBoOZ7NQj%2bzN8Dalt5Qsxijptko5wJkU7CnHf8uJOw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/45cd9142-6feb-4946-89e7-63e58fada30a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/45cd9142-6feb-4946-89e7-63e58fada30a?P1=1787638061&P2=404&P3=2&P4=SIvPRiIgz%2bsF4apdhdj8sfRSlZ5m0WZw2daVOhztmoxEs5b5fctJW1ohxfoWvmiq0O%2fN57J2c3P16CbtwHyTOw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded IP addresses

20.42.65.91
52.123.252.245
85.210.193.152
20.247.185.124
4.230.171.124
74.179.77.204
20.184.175.22
20.236.44.162
52.123.128.14
52.123.129.14
20.165.94.54
20.42.65.94
52.123.252.244
203.26.79.13
172.178.240.161
135.232.92.34
52.148.114.188
172.66.2.5
72.154.7.105
92.223.78.30
52.110.12.33
52.110.12.52

More Upantix samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report